CVE-2026-8391: mozilla firefox Improper Input Validation

Vulnerability summary

CVE-2026-8391 is a medium (CVSS 5.3) Improper Input Validation vulnerability in mozilla firefox. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.2% of scored vulnerabilities.

Timeline

1. 12-05-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
• CWE-475Undefined Behavior for Input to APIThe behavior of this function is undefined unless its control parameter is set to a specific value.